Is there a site that will scan my website and check it for security holes?

Question

Is there a site that will scan my website and check it for security holes?

Preferably one that doesn't charge.

Answer 1

You might want to look into WebScarab.

WebScarab is a framework for analysing applications that communicate using the HTTP and HTTPS protocols. It is written in Java, and is thus portable to many platforms. WebScarab has several modes of operation, implemented by a number of plugins. In its most common usage, WebScarab operates as an intercepting proxy, allowing the operator to review and modify requests created by the browser before they are sent to the server, and to review and modify responses returned from the server before they are received by the browser. WebScarab is able to intercept both HTTP and HTTPS communication. The operator can also review the conversations (requests and responses) that have passed through WebScarab.

Vulnerability assessment in web applications and web sites is not common available for free, and usually involves hiring a security consultant/researcher.

Answer 2

I asked about Web Vuln scanners over on Server Fault recently. The only hosted option that was suggested was WebsiteOptimization.com's Security service. I haven't tried it yet, but they do offer a 14 day freebie.

Answer 3

Take a look at ShieldsUp by Gibson Research (www.grc.com). I've used it in the past. And it is free.

Answer 4

There are some, but the free ones don't really tell you anything useful. I have personally yet to find a tool that fuzzes the input fields of every form and tests for sql vulnerabilities that seems... reputable. You sort of are best off doing this stuff by hand and going through a check list.